The company will pay damages to people taking drugs to treat or prevent HIV and received letters that made this information visible.

The insurer Aetna mailed letters to its clients in July that may have revealed their HIV statuses to anyone who saw the envelope, according to the company and the Legal Action Center and the AIDS Law Project of Pennsylvania.

The letters contained instructions for filling HIV-related prescriptions, and were sent to Aetna clients who were taking medication to treat HIV as well as those using pre-exposure prophylaxis (PrEP), a drug that can prevent HIV infection. The mailings were sent in an envelope with a large plastic window; in some cases, that window may have revealed the beginning of the letter, including the client's name and a mention of HIV prescriptions.

It's unclear how many clients may have received the revealing letters. According to Bloomberg, Aetna says about 12,000 of the letters were sent in July, but a correction issued by STAT News suggested that an unknown number of envelopes actually revealed people's personal information. It sent a follow-up letter to affected clients explaining that the original mailing may have shifted within the envelope, revealing more than just the client's address.

"We sincerely apologize to those affected by a mailing issue that inadvertently exposed the personal health information of some Aetna members," the company said in a statement emailed to Tonic. "This type of mistake is unacceptable, and we are undertaking a full review of our processes to ensure something like this never happens again." It's in the process of notifying state and federal regulatory agencies about the problem.

The Legal Action Center and the AIDS Law Project of Pennsylvania told CNN that it's received 23 complaints thus far, from Arizona, California, Georgia, Illinois, New Jersey, New York, Ohio, Pennsylvania, and the District of Columbia. It says more are coming in. On Thursday, the organizations addressed a letter to Aetna demanding an end to the mailings, which they say could lead to discrimination against patients.

"I know of someone who has been kicked out of his home because somebody who saw his envelope learned his HIV status," Sally Friedman, legal director of the Legal Action Center, told CNN. The organizations are considering legal action.

Update 8/29/17: The Legal Action Center and the AIDS Law Project of Pennsylvania have filed a class-action lawsuit against Aetna. The suit demands that Aetna stop sending information about HIV medications through the mail, reform its procedures, and pay damages.

Update 1/18/18: Aetna has agreed to pay more than $17 million to settle the class-action lawsuit brought against it for breach of privacy; the settlement still requires court approval. The company has agreed to pay at least $500 to the nearly 12,000 customers whose privacy was breeched by the envelopes and $75 to an additional 1,600 people whose names were disclosed to a mail vendor and Aetna's legal counsel but who did not receive a large-windowed envelope. People who experienced additional financial and emotional distress can claim up to $20,000 from a $12 million fund. In September, the company began offering reimbursements to customers who said they suffered financial hardship as a direct result of the privacy breach, and offered counseling services for affected customers and their families. The company said in a statement:

Through our outreach efforts, immediate relief program and this settlement we have worked to address the potential impact to members following this unfortunate incident. In addition, we are implementing measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive health information.